Default rules conflict with DHCP about firewalld HOT 5 CLOSED

Only dhcpdv6-client is enabled by default in the firewall, as this is essential for mostly all clients using IPv6.
You can simply enable the dhcp service in your configuration to allow access to the dhcp server provided by systemd-networkd. If systemd-networkd is also providing a dhcpv6 server, then also enable dhcpv6.

from firewalld.

The problem is that this breaks systemd-nspwan containers:
systemd/systemd#2552

The default policy needs to not break systemd on ve-* interfaces.

from firewalld.

I agree there's a conflict, but I'd like to note it goes beyond DHCP. Containers launched with systemd-nspawn -n are also intended to have internet access, e.g. for dnf.

(The default config for systemd-networkd enables ipv4 masquerading for this).

After allowing access to DHCP in firewalld, you get an address, but internet-bound packets are rejected as "administratively prohibited":

# traceroute 8.8.8.8   
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  gateway (10.0.0.1)  0.091 ms  0.031 ms  0.026 ms
 2  gateway (10.0.0.1)  0.033 ms !X  0.028 ms !X  0.028 ms !X

from firewalld.

sudo firewall-cmd --add-service=dhcp

I think this issue could be closed.

from firewalld.

The default policy needs to not break systemd on ve-* interfaces.

Firewalld upstream is not going to allow DHCP server by default. That can either be done statically by the distribution, or at runtime by the container startup.

After allowing access to DHCP in firewalld, you get an address, but internet-bound packets are rejected as "administratively prohibited":

Firewalld filters forwarded packets by default. You can add the container's interface to the trusted zone to remedy this.

from firewalld.